fc99b9483117e98d618fa709c9bff4944f52c445c452ee8fea3e92ca3e720e60

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
21/04/2026, 12:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Invoice-PRMREGVK-0003.exe
Size 21.8MB
Sample260421-plc8msew2n
SHA256 fc99b9483117e98d618fa709c9bff4944f52c445c452ee8fea3e92ca3e720e60
MD5 d77bf25b85a45f68d7601a9b7d74c9d9
SHA1 8654d930b771f744c37d5afb2df51f4ae95801ed
SHA512 d0c763e0e0736ca6365f34e0c7eea606633ae2453e599a823c5165a7e68008a6dc04deb73ef5c847e03be42600be2dd8f418f57e3f33bf5a143e9cfd686bc514
SSDEEP 393216:+tolZoSUFNgCMOhVoBaAiUNaL70q1uzCJPeT8FJnehMOe5NI+Wb3Q:+tobo/qEVooAZNKYeJPeTe9B5JWc
TLSH
T159373338F6E55CBEDE3BAAFCD09E449B575AB5A603C4012327F1C6D28B213D4542EE09
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery persistence privilege_escalation

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 5 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2568	netsh.exe
1016	netsh.exe
4384	netsh.exe
3524	netsh.exe
2072	netsh.exe

Executes dropped EXE 26 IoCs

pid	Process
4684	unpack200.exe
2560	unpack200.exe
4204	unpack200.exe
536	unpack200.exe
3412	unpack200.exe
2700	unpack200.exe
236	unpack200.exe
2240	unpack200.exe
1260	windowslauncher.exe
2832	unpack200.exe
3524	unpack200.exe
1984	unpack200.exe
3404	unpack200.exe
3168	Remote AccessLauncher.exe
4516	Remote Access.exe
4444	SimpleService.exe
2168	SimpleService.exe
4796	SimpleService.exe
5100	Remote Access Service.exe
1868	Remote Access.exe
1648	session_win.exe
4572	elev_win.exe
3556	session_win.exe
1068	elev_win.exe
1116	session_win.exe
2000	elev_win.exe

Loads dropped DLL 55 IoCs

pid	Process
4684	unpack200.exe
2560	unpack200.exe
4204	unpack200.exe
536	unpack200.exe
3412	unpack200.exe
2700	unpack200.exe
236	unpack200.exe
2240	unpack200.exe
2832	unpack200.exe
3524	unpack200.exe
1984	unpack200.exe
3404	unpack200.exe
396	Invoice-PRMREGVK-0003.exe
396	Invoice-PRMREGVK-0003.exe
396	Invoice-PRMREGVK-0003.exe
396	Invoice-PRMREGVK-0003.exe
396	Invoice-PRMREGVK-0003.exe
396	Invoice-PRMREGVK-0003.exe
396	Invoice-PRMREGVK-0003.exe
396	Invoice-PRMREGVK-0003.exe
3168	Remote AccessLauncher.exe
3168	Remote AccessLauncher.exe
3168	Remote AccessLauncher.exe
3168	Remote AccessLauncher.exe
3168	Remote AccessLauncher.exe
3168	Remote AccessLauncher.exe
3168	Remote AccessLauncher.exe
4516	Remote Access.exe
4516	Remote Access.exe
4516	Remote Access.exe
4516	Remote Access.exe
4516	Remote Access.exe
4516	Remote Access.exe
4516	Remote Access.exe
4516	Remote Access.exe
4516	Remote Access.exe
4516	Remote Access.exe
1868	Remote Access.exe
1868	Remote Access.exe
1868	Remote Access.exe
1868	Remote Access.exe
1868	Remote Access.exe
1868	Remote Access.exe
1868	Remote Access.exe
1868	Remote Access.exe
1868	Remote Access.exe
1868	Remote Access.exe
1868	Remote Access.exe
1868	Remote Access.exe
1868	Remote Access.exe
1868	Remote Access.exe
1868	Remote Access.exe
1868	Remote Access.exe
1868	Remote Access.exe
1868	Remote Access.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File created	C:\Windows\rescache\_merged\566188972\3188645044.pri	netsh.exe
File created	C:\Windows\rescache\_merged\718100698\1663845057.pri	netsh.exe
File created	C:\Windows\rescache\_merged\98783150\3743013027.pri	netsh.exe
File created	C:\Windows\rescache\_merged\1831202810\2911160158.pri	netsh.exe
File created	C:\Windows\rescache\_merged\3989159129\3864352903.pri	netsh.exe
File created	C:\Windows\rescache\_merged\4062111013\4109460457.pri	netsh.exe
File created	C:\Windows\rescache\_merged\3766950118\1407438774.pri	netsh.exe
File created	C:\Windows\rescache\_merged\4052159476\2223258717.pri	netsh.exe
File created	C:\Windows\rescache\_merged\1388509667\1982473886.pri	netsh.exe
File created	C:\Windows\rescache\_merged\2343073371\1075347380.pri	netsh.exe
File created	C:\Windows\rescache\_merged\3559780703\3233384990.pri	netsh.exe
File created	C:\Windows\rescache\_merged\2878548818\271645666.pri	netsh.exe
File created	C:\Windows\rescache\_merged\2879188468\3076645539.pri	netsh.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 15 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Remote Access Service.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	session_win.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	elev_win.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	session_win.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	session_win.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SimpleService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SimpleService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.LockApp_cw5n1h2txyewy%5Cresources.pri\1d7d186ced600b3\a01460c8\@{Microsoft.LockApp_10.0.22000.1_neutral__cw5n1h2txyewy?ms-resource://Microsoft.LockApp/re = "Windows Default Lock Screen"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5Cmicrosoft.windows.narratorquickstart_8wekyb3d8bbwe%5Cresources.pri	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5Cmicrosoft.windows.narratorquickstart_8wekyb3d8bbwe%5Cresources.pri\1d75a03ea4ecf3\a01460c8	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5Cmicrosoft.windows.narratorquickstart_8wekyb3d8bbwe%5Cresources.pri\1d75a03ea4ecf3	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.AAD.BrokerPlugin_cw5n1h2txyewy%5Cresources.pri\1d75a0383a0870\a01460c8	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.Search_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.AppRep.ChxApp_cw5n1h2txyewy%5Cresources.pri\1d75a031035819f	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.LockApp_cw5n1h2txyewy%5Cresources.pri\1d7d186ced600b3\a01460c8	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.Search_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CParentalControls_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.ContentDeliveryManager_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.Search_cw5n1h2txyewy%5Cresources.pri\1d7d187d47a1c02	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoftWindows.Client.CBS_cw5n1h2txyewy%5Cresources.pri\1d83dd0881b7f39\a01460c8	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy%5Cresources.pri\1d75a03dcbf1be	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@peerdistsh.dll,-9002 = "BranchCache - Hosted Cache Server (Uses HTTPS)"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.XboxGameCallableUI_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.XboxGameCallableUI_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoftWindows.Client.CBS_cw5n1h2txyewy%5Cresources.pri\1d83dd0881b7f39	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\firewallapi.dll,-53500 = "Recommended Troubleshooting"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Win32WebViewHost_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Win32WebViewHost_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.AAD.BrokerPlugin_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.PeopleExperienceHost_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.PeopleExperienceHost_cw5n1h2txyewy%5Cresources.pri\1d75a03db8de77\a01460c8	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.LockApp_cw5n1h2txyewy%5Cresources.pri\1d7d186ced600b3	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy%5Cresources.pri\1d75a17566f896a\a01460c8	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CParentalControls_cw5n1h2txyewy%5Cresources.pri\1d75a0311147cb	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy%5Cresources.pri\1d75a03dbb3ff1	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy%5Cresources.pri\1d75a03dbb3ff1\a01460c8\@{Microsoft.Windows.StartMenuExperienceHost_10.0.22000.37_neutral_n = "Start"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoftWindows.Client.CBS_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.LockApp_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5Cmicrosoft.windows.narratorquickstart_8wekyb3d8bbwe%5Cresources.pri\1d75a03ea4ecf3\a01460c8\@{Microsoft.Windows.NarratorQuickStart_10.0.22000.1_neutral_neutral_8wek = "Narrator"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CParentalControls_cw5n1h2txyewy%5Cresources.pri\1d75a0311147cb\a01460c8	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy%5Cresources.pri\1d75a03dcbf1be\a01460c8	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy%5Cresources.pri\1d75a17566f896a\a01460c8\@{Microsoft.Windows.SecureAssessmentBrowser_10.0.22000.1_neutral_n = "Take a Test"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.CloudExperienceHost_cw5n1h2txyewy%5Cresources.pri\1d7d186bed84ec6\a01460c8	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@peerdistsh.dll,-9000 = "BranchCache - Content Retrieval (Uses HTTP)"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@sstpsvc.dll,-35001 = "Secure Socket Tunneling Protocol"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@wlansvc.dll,-36864 = "WLAN Service - WFD Application Services Platform Coordination Protocol (Uses UDP)"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.AppRep.ChxApp_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Win32WebViewHost_cw5n1h2txyewy%5Cresources.pri\1d75a032a505f68\a01460c8\@{Microsoft.Win32WebViewHost_10.0.22000.1_neutral_neutral_cw5n1h2txyewy?ms-resour = "Desktop App Web Viewer"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.AppRep.ChxApp_cw5n1h2txyewy%5Cresources.pri\1d75a031035819f\a01460c8	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.AppRep.ChxApp_cw5n1h2txyewy%5Cresources.pri\1d75a031035819f\a01460c8\@{Microsoft.Windows.Apprep.ChxApp_1000.22000.1.0_neutral_neutral_cw5n1h2txye = "Windows Defender SmartScreen"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.LockApp_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.CloudExperienceHost_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.PeopleExperienceHost_cw5n1h2txyewy%5Cresources.pri\1d75a03db8de77\a01460c8\@{Microsoft.Windows.PeopleExperienceHost_10.0.22000.1_neutral_neutral_ = "Windows Shell Experience"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.XboxGameCallableUI_cw5n1h2txyewy%5Cresources.pri\1d75a0324ef8be\a01460c8	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.XboxGameCallableUI_cw5n1h2txyewy%5Cresources.pri\1d75a0324ef8be	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy%5Cresources.pri\1d75a17566f896a	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy%5Cresources.pri\1d75a03dcbf1be\a01460c8\@{Microsoft.Windows.OOBENetworkCaptivePortal_10.0.21302.1000_neutr = "Captive Portal Flow"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\icsvc.dll,-700 = "Virtual Machine Monitoring"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.AccountsControl_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CParentalControls_cw5n1h2txyewy%5Cresources.pri\1d75a0311147cb\a01460c8\@{Microsoft.Windows.ParentalControls_1000.22000.1.0_neutral_neutral_cw5n1h2txyewy?ms-resourc = "Microsoft family features"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.ContentDeliveryManager_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.Search_cw5n1h2txyewy%5Cresources.pri\1d7d187d47a1c02\a01460c8\@{Microsoft.Windows.Search_1.16.0.22000_neutral_neutral_cw5n1h2txyewy?ms-resource:/ = "Windows Search"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy%5Cresources.pri\1d75a03dbb3ff1\a01460c8	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.AAD.BrokerPlugin_cw5n1h2txyewy%5Cresources.pri\1d75a0383a0870	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@peerdistsh.dll,-9001 = "BranchCache - Peer Discovery (Uses WSD)"	netsh.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1648	session_win.exe
1648	session_win.exe
3556	session_win.exe
3556	session_win.exe
1116	session_win.exe
1116	session_win.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1868	Remote Access.exe

Suspicious use of WriteProcessMemory 59 IoCs

description	pid	Process	procid_target
PID 396 wrote to memory of 4684	396	Invoice-PRMREGVK-0003.exe	79
PID 396 wrote to memory of 2560	396	Invoice-PRMREGVK-0003.exe	80
PID 396 wrote to memory of 4204	396	Invoice-PRMREGVK-0003.exe	81
PID 396 wrote to memory of 536	396	Invoice-PRMREGVK-0003.exe	82
PID 396 wrote to memory of 3412	396	Invoice-PRMREGVK-0003.exe	83
PID 396 wrote to memory of 2700	396	Invoice-PRMREGVK-0003.exe	84
PID 396 wrote to memory of 236	396	Invoice-PRMREGVK-0003.exe	85
PID 396 wrote to memory of 2240	396	Invoice-PRMREGVK-0003.exe	86
PID 396 wrote to memory of 1260	396	Invoice-PRMREGVK-0003.exe	87
PID 396 wrote to memory of 2832	396	Invoice-PRMREGVK-0003.exe	88
PID 396 wrote to memory of 3524	396	Invoice-PRMREGVK-0003.exe	89
PID 396 wrote to memory of 1984	396	Invoice-PRMREGVK-0003.exe	90
PID 396 wrote to memory of 3404	396	Invoice-PRMREGVK-0003.exe	91
PID 396 wrote to memory of 3196	396	Invoice-PRMREGVK-0003.exe	92
PID 396 wrote to memory of 4532	396	Invoice-PRMREGVK-0003.exe	94
PID 396 wrote to memory of 1712	396	Invoice-PRMREGVK-0003.exe	96
PID 396 wrote to memory of 4080	396	Invoice-PRMREGVK-0003.exe	97
PID 396 wrote to memory of 1624	396	Invoice-PRMREGVK-0003.exe	100
PID 396 wrote to memory of 3340	396	Invoice-PRMREGVK-0003.exe	102
PID 396 wrote to memory of 768	396	Invoice-PRMREGVK-0003.exe	103
PID 396 wrote to memory of 3168	396	Invoice-PRMREGVK-0003.exe	106
PID 3168 wrote to memory of 3160	3168	Remote AccessLauncher.exe	107
PID 396 wrote to memory of 2024	396	Invoice-PRMREGVK-0003.exe	109
PID 396 wrote to memory of 3816	396	Invoice-PRMREGVK-0003.exe	111
PID 396 wrote to memory of 1136	396	Invoice-PRMREGVK-0003.exe	112
PID 396 wrote to memory of 3080	396	Invoice-PRMREGVK-0003.exe	113
PID 396 wrote to memory of 3120	396	Invoice-PRMREGVK-0003.exe	114
PID 396 wrote to memory of 4516	396	Invoice-PRMREGVK-0003.exe	119
PID 4516 wrote to memory of 4260	4516	Remote Access.exe	120
PID 4516 wrote to memory of 2332	4516	Remote Access.exe	122
PID 4516 wrote to memory of 1656	4516	Remote Access.exe	124
PID 4516 wrote to memory of 3228	4516	Remote Access.exe	126
PID 4516 wrote to memory of 1640	4516	Remote Access.exe	128
PID 4516 wrote to memory of 2464	4516	Remote Access.exe	129
PID 4516 wrote to memory of 4616	4516	Remote Access.exe	131
PID 4516 wrote to memory of 4444	4516	Remote Access.exe	134
PID 4516 wrote to memory of 2168	4516	Remote Access.exe	135
PID 4796 wrote to memory of 5100	4796	SimpleService.exe	137
PID 5100 wrote to memory of 1868	5100	Remote Access Service.exe	138
PID 1868 wrote to memory of 2784	1868	Remote Access.exe	139
PID 1868 wrote to memory of 1884	1868	Remote Access.exe	141
PID 1868 wrote to memory of 1248	1868	Remote Access.exe	143
PID 1868 wrote to memory of 2368	1868	Remote Access.exe	144
PID 1868 wrote to memory of 2868	1868	Remote Access.exe	147
PID 1868 wrote to memory of 1636	1868	Remote Access.exe	149
PID 1868 wrote to memory of 3524	1868	Remote Access.exe	151
PID 1868 wrote to memory of 4172	1868	Remote Access.exe	153
PID 1868 wrote to memory of 2072	1868	Remote Access.exe	155
PID 1868 wrote to memory of 2568	1868	Remote Access.exe	157
PID 1868 wrote to memory of 1016	1868	Remote Access.exe	159
PID 1868 wrote to memory of 4384	1868	Remote Access.exe	161
PID 1868 wrote to memory of 1144	1868	Remote Access.exe	164
PID 1868 wrote to memory of 2804	1868	Remote Access.exe	166
PID 1868 wrote to memory of 1648	1868	Remote Access.exe	168
PID 1648 wrote to memory of 4572	1648	session_win.exe	169
PID 1868 wrote to memory of 3556	1868	Remote Access.exe	170
PID 3556 wrote to memory of 1068	3556	session_win.exe	171
PID 1868 wrote to memory of 1116	1868	Remote Access.exe	172
PID 1116 wrote to memory of 2000	1116	session_win.exe	173

C:\Users\Admin\AppData\Local\Temp\Invoice-PRMREGVK-0003.exe
"C:\Users\Admin\AppData\Local\Temp\Invoice-PRMREGVK-0003.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:396
- C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774525-4-app\bin\unpack200.exe
  "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774525-4-app\bin\unpack200.exe" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774525-4-app\lib\charsets.jar.p2" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774525-4-app\lib\charsets.jar"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4684
- C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774525-4-app\bin\unpack200.exe
  "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774525-4-app\bin\unpack200.exe" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774525-4-app\lib\ext\access-bridge-64.jar.p2" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774525-4-app\lib\ext\access-bridge-64.jar"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2560
- C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774525-4-app\bin\unpack200.exe
  "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774525-4-app\bin\unpack200.exe" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774525-4-app\lib\ext\cldrdata.jar.p2" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774525-4-app\lib\ext\cldrdata.jar"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4204
- C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774525-4-app\bin\unpack200.exe
  "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774525-4-app\bin\unpack200.exe" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774525-4-app\lib\ext\jaccess.jar.p2" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774525-4-app\lib\ext\jaccess.jar"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:536
- C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774525-4-app\bin\unpack200.exe
  "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774525-4-app\bin\unpack200.exe" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774525-4-app\lib\ext\sunmscapi.jar.p2" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774525-4-app\lib\ext\sunmscapi.jar"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3412
- C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774525-4-app\bin\unpack200.exe
  "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774525-4-app\bin\unpack200.exe" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774525-4-app\lib\ext\sunpkcs11.jar.p2" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774525-4-app\lib\ext\sunpkcs11.jar"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2700
- C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774525-4-app\bin\unpack200.exe
  "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774525-4-app\bin\unpack200.exe" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774525-4-app\lib\jsse.jar.p2" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774525-4-app\lib\jsse.jar"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:236
- C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774525-4-app\bin\unpack200.exe
  "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774525-4-app\bin\unpack200.exe" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774525-4-app\lib\rt.jar.p2" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774525-4-app\lib\rt.jar"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2240
- C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774525-4-app\bin\windowslauncher.exe
  "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774525-4-app\bin\windowslauncher.exe" "-Xshare:dump"
  2⤵
  - Executes dropped EXE
  PID:1260
- C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00063527423-complete\bin\unpack200.exe
  "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00063527423-complete\bin\unpack200.exe" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774524-3-app\customer.jar.p2" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774524-3-app\customer.jar"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2832
- C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00063527423-complete\bin\unpack200.exe
  "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00063527423-complete\bin\unpack200.exe" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774524-3-app\pdfbox-2.0.19.jar.p2" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774524-3-app\pdfbox-2.0.19.jar"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3524
- C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00063527423-complete\bin\unpack200.exe
  "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00063527423-complete\bin\unpack200.exe" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774524-3-app\fontbox-2.0.19.jar.p2" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774524-3-app\fontbox-2.0.19.jar"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1984
- C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00063527423-complete\bin\unpack200.exe
  "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00063527423-complete\bin\unpack200.exe" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774524-3-app\jwrapper_utils.jar.p2" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774524-3-app\jwrapper_utils.jar"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3404
- C:\Windows\SYSTEM32\cacls.exe
  cacls "C:\ProgramData\JWrapper-Remote Access\JWApps" /e /g "Users":F
  2⤵
  PID:3196
- C:\Windows\SYSTEM32\cacls.exe
  cacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\LastProxy" /e /g "Users":F
  2⤵
  PID:4532
- C:\Windows\SYSTEM32\cacls.exe
  cacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\DetectedProxies" /e /g "Users":F
  2⤵
  PID:1712
- C:\Windows\SYSTEM32\cacls.exe
  cacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\ProxyCredentials" /e /g "Users":F
  2⤵
  PID:4080
- C:\Windows\SYSTEM32\cacls.exe
  cacls "C:\ProgramData\JWrapper-Remote Access\JWApps\Remote_Access_ConfigureICO.ico" /e /g "Users":F
  2⤵
  PID:1624
- C:\Windows\SYSTEM32\cacls.exe
  cacls "C:\ProgramData\JWrapper-Remote Access\JWApps\JWrapper-Remote Access-UninstallerICO.ico" /e /g "Users":F
  2⤵
  PID:3340
- C:\Windows\SYSTEM32\cacls.exe
  cacls "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\unrestricted" /e /g "Users":F
  2⤵
  PID:768
- C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00063527423-complete\bin\Remote AccessLauncher.exe
  "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00063527423-complete\bin\Remote AccessLauncher.exe" -cp "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\jwrapper_utils.jar;C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\customer.jar;C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\pdfbox-2.0.19.jar;C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\fontbox-2.0.19.jar" -Xmx256m -Xms5m -XX:MinHeapFreeRatio=15 -XX:MaxHeapFreeRatio=30 -XX:MaxGCPauseMillis=500 -Djava.util.Arrays.useLegacyMergeSort=true -Djava.net.preferIPv4Stack=true -Dapple.awt.UIElement=true -Xrs -Dsun.java2d.dpiaware=true -Dhttps.protocols=TLSv1,TLSv1.1,TLSv1.2 jwrapper.JWrapper "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\unrestricted\JWLaunchProperties-1776774534732-0"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:3168
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWApps\JRE-LastSuccessfulOptions-JWrapper-Windows64JRE-00063527423-complete" /e /g "Users":F
    3⤵
    PID:3160
- C:\Windows\SYSTEM32\cacls.exe
  cacls "C:\ProgramData\JWrapper-Remote Access\JWApps\ChosenLanguage" /e /g "Users":F
  2⤵
  PID:2024
- C:\Windows\SYSTEM32\cacls.exe
  cacls "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\unrestricted\jwLastRun" /e /g "Users":F
  2⤵
  PID:3816
- C:\Windows\SYSTEM32\cacls.exe
  cacls "C:\ProgramData\JWrapper-Remote Access\JWrapper-JWrapper-00075795284-complete\unrestricted\jwLastRun" /e /g "Users":F
  2⤵
  PID:1136
- C:\Windows\SYSTEM32\cacls.exe
  cacls "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00063527423-complete\unrestricted" /e /g "Users":F
  2⤵
  PID:3080
- C:\Windows\SYSTEM32\cacls.exe
  cacls "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00063527423-complete\unrestricted\jwLastRun" /e /g "Users":F
  2⤵
  PID:3120
- C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00063527423-complete\bin\Remote Access.exe
  "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00063527423-complete\bin\Remote Access.exe" -cp "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\jwrapper_utils.jar;C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\customer.jar;C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\pdfbox-2.0.19.jar;C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\fontbox-2.0.19.jar" -Xmx256m -Xms5m -XX:MinHeapFreeRatio=15 -XX:MaxHeapFreeRatio=30 -XX:MaxGCPauseMillis=500 -Djava.util.Arrays.useLegacyMergeSort=true -Djava.net.preferIPv4Stack=true -Dapple.awt.UIElement=true -Xrs -Dsun.java2d.dpiaware=true -Dhttps.protocols=TLSv1,TLSv1.1,TLSv1.2 jwrapper.JWrapper "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\unrestricted\JWLaunchProperties-1776774535279-1"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:4516
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWApps\JRE-LastSuccessfulOptions-JWrapper-Windows64JRE-00063527423-complete" /e /g "Users":F
    3⤵
    PID:4260
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\serviceconfig.xml" /e /p "Users":R
    3⤵
    PID:2332
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\Remote Access Service.exe" /t /e /g "Users":F
    3⤵
    PID:1656
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\Remote Access Service.exe" /t /e /p "Users":R
    3⤵
    PID:3228
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\StopSimpleGatewayService.exe" /t /e /g "Users":F
    3⤵
    PID:1640
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\StopSimpleGatewayService.exe" /t /e /p "Users":R
    3⤵
    PID:2464
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\restricted" /t /e /p "Users":R
    3⤵
    PID:4616
- - C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\restricted\SimpleService.exe
    "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\restricted\SimpleService.exe" -uninstall "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\simplegateway.service"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4444
- - C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\restricted\SimpleService.exe
    "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\restricted\SimpleService.exe" -install "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\simplegateway.service"
    3⤵
    - Executes dropped EXE
    PID:2168

C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\restricted\SimpleService.exe
"C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\restricted\SimpleService.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4796
- C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\Remote Access Service.exe
  "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\Remote Access Service.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5100
- - C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00063527423-complete\bin\Remote Access.exe
    "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00063527423-complete\bin\Remote Access.exe" "-Xmx256m" "-Xms5m" "-XX:MinHeapFreeRatio=15" "-XX:MaxHeapFreeRatio=30" "-XX:MaxGCPauseMillis=500" "-Djava.util.Arrays.useLegacyMergeSort=true" "-Djava.net.preferIPv4Stack=true" "-Dapple.awt.UIElement=true" "-Xrs" "-Dsun.java2d.dpiaware=true" "-Dhttps.protocols=TLSv1,TLSv1.1,TLSv1.2" "-cp" "C:\ProgramData\JWrapper-Remote Access\JWrapper-JWrapper-00075795284-complete\jwrapperlib\jwstandalonelaunch.jar" "jwrapper.updater.GenericUpdaterLaunch" "C:\ProgramData\JWrapper-Remote Access\JWrapper-JWrapper-00075795284-complete\unrestricted\JWLaunchProperties-2953043922-20"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1868
  - - C:\Windows\SYSTEM32\cacls.exe
      cacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\DetectedProxies" /e /g "Users":F
      4⤵
      PID:2784
  - - C:\Windows\SYSTEM32\cacls.exe
      cacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\ProxyCredentials" /e /g "Users":F
      4⤵
      PID:1884
  - - C:\Windows\SYSTEM32\cacls.exe
      cacls "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\unrestricted\jwLastRun" /e /g "Users":F
      4⤵
      PID:1248
  - - C:\Windows\SYSTEM32\cacls.exe
      cacls "C:\ProgramData\JWrapper-Remote Access\JWrapper-JWrapper-00075795284-complete\unrestricted\jwLastRun" /e /g "Users":F
      4⤵
      PID:2368
  - - C:\Windows\SYSTEM32\cacls.exe
      cacls "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00063527423-complete\unrestricted\jwLastRun" /e /g "Users":F
      4⤵
      PID:2868
  - - C:\Windows\SYSTEM32\cacls.exe
      cacls "C:\ProgramData\JWrapper-Remote Access\JWApps\JRE-LastSuccessfulOptions-JWrapper-Windows64JRE-00063527423-complete" /e /g "Users":F
      4⤵
      PID:1636
  - - C:\Windows\SYSTEM32\netsh.exe
      netsh advfirewall firewall show rule name=all
      4⤵
      Modifies Windows Firewall
      Drops file in Windows directory
      Event Triggered Execution: Netsh Helper DLL
      Modifies data under HKEY_USERS
      PID:3524
  - - C:\Windows\SYSTEM32\cacls.exe
      cacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\serviceid.lock" /t /e /g "Users":f
      4⤵
      PID:4172
  - - C:\Windows\SYSTEM32\netsh.exe
      netsh advfirewall firewall add rule "name=SH Remote Access Service" "description=Inbound rule for the Remote Access Service to facilitate access sessions" dir=in action=allow "program=C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00063527423-complete\bin\Remote Access.exe"
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:2072
  - - C:\Windows\SYSTEM32\netsh.exe
      netsh advfirewall firewall add rule "name=SH Remote Access Service Updater" "description=Inbound rule for the Remote Access Service updater" dir=in action=allow "program=C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00063527423-complete\bin\Remote AccessECompatibility.exe"
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:2568
  - - C:\Windows\SYSTEM32\netsh.exe
      netsh advfirewall firewall add rule "name=SH Remote Access Service Launcher" "description=Inbound rule for the launcher that can spawn the Remote Access Service" dir=in action=allow "program=C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00063527423-complete\bin\Remote AccessLauncher.exe"
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:1016
  - - C:\Windows\SYSTEM32\netsh.exe
      netsh advfirewall firewall show rule name=all
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      Modifies data under HKEY_USERS
      PID:4384
  - - C:\Windows\SYSTEM32\cacls.exe
      cacls "C:\ProgramData\SimpleHelp" /t /e /g "Users":f
      4⤵
      PID:1144
  - - C:\Windows\SYSTEM32\cacls.exe
      cacls "C:\ProgramData\SimpleHelp\ElevateSH\*.*" /t /e /g "Users":f
      4⤵
      PID:2804
  - - C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\session_win.exe
      "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\session_win.exe" --slWaitForCompletion "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\elev_win.exe" --mouselocation
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1648
    - - C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\elev_win.exe
        
        "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\elev_win.exe" "--mouselocation"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4572
  - - C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\session_win.exe
      "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\session_win.exe" --slWaitForCompletion "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\elev_win.exe" --mouselocation
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:3556
    - - C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\elev_win.exe
        
        "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\elev_win.exe" "--mouselocation"
        5⤵
        Executes dropped EXE
        
        PID:1068
  - - C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\session_win.exe
      "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\session_win.exe" --slWaitForCompletion "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\elev_win.exe" --mouselocation
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1116
    - - C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\elev_win.exe
        
        "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\elev_win.exe" "--mouselocation"
        5⤵
        Executes dropped EXE
        
        PID:2000

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DetectedProxies

Path C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\DetectedProxies
Size 4B
SHA256 df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119
MD5 f1d3ff8443297732862df21dc4e57262
SHA1 9069ca78e7450a285173431b3e52c5c25299e473
SHA512 ec2d57691d9b2d40182ac565032054b7d784ba96b18bcb5be0bb4e70e3fb041eff582c8af66ee50256539f2181d7f9e53627c0189da7e75a4d5ef10ea93b20b3
MD5 SHA1 SHA512

Submit Download

secmsg-udpGVV18U139U243U159G9999.secmsg.afos_complete

Path C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\secmsg\secmsg-udpGVV18U139U243U159G9999.secmsg.afos_complete
Size 144B
SHA256 00decdd2be4f7084ac11951a7b8d3d861e5c011fbc3a4a981fe8aff978207025
MD5 514911b4dd75fbbcce9df95423f7bf1e
SHA1 68a1d32f3c25159b2258350663092b20acdb0e6e
SHA512 c3af47117b9f0706af1a1ee4af7c89da28f3901190eca51a66ddcbf846ce41061cac8cf008d22f5c96deb6c4aae36b6ffcb6ef884fbf25adba0f7805388e57e5
TLSH
T1E1C02B1F0440B5B1E394008862C000C238C18C90D393D49CDF150C485C837B0304F73B
MD5 SHA1 SHA512 TLSH

Submit Download

serviceconfig.xml

Path C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\serviceconfig.xml
Size 363B
SHA256 08b433805e324a81719b58b0add7cea909140c4514f4792b1fb22398301605fc
MD5 9a88182402d9c0e3f392335b11b87d50
SHA1 46fa893e221b08166d0aafa8b31fff98ddc28afa
SHA512 bf6319d5d72b5658865a0cc621101e98441d4b0a57f3345dd5711539b5e1ff7826fbd4bdba97e2f8a7f27d490fee807500cad8a5bd381637e8b5737e958bd970
TLSH
T179E02096F0A2F1BB92CD5347C831406C0B704A0857349889FDD94150FECE1743F1F8A0
MD5 SHA1 SHA512 TLSH

Submit Download

serviceconfig.xml

Path C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\serviceconfig.xml
Size 361B
SHA256 c69c4ee25e40bd26fafda3aeddd738ae2ee40b65ba98d2700faff6a764ec5a68
MD5 f96796754dc24e308b98fd5b996951d9
SHA1 a591177f9b9eebf14f327ba269d7a333c2b1fd6c
SHA512 50e8f03c8c27d5af514dcc62ffbc03db4c466e12921e47fc042dc6507cd80445f502dc5734fb57a0637aad4168f8fd82677444573304be87e971e299c958f839
TLSH
T10FE0D8A6F4A2B17B92CD534BC82140AC0B704A086A38888AFDD54550BECA1743F1F8A0
MD5 SHA1 SHA512 TLSH

Submit Download

serviceconfig.xml

Path C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\serviceconfig.xml
Size 499B
SHA256 a9c221582cfa33f1899878b2781e2538f232bd9bd7510e0971b5c5d46a66ac6b
MD5 ab1ace36b9c5b0aa5bb855425bc7201f
SHA1 afbbad149b1b025edd2de09ec146037f52648508
SHA512 eef717ae3ebe35a47145e2896560e48119e86a15d904fd427e3cd6e26902ba759b76340a0566a0a04f2efea9a95dfa93327cd6241a4199620eee549f04a4fac5
TLSH
T1E8F05961E5A2A17AE2FEA38BC821017C1B7485146638488AFDA44561AE8B1757F2B8F0
MD5 SHA1 SHA512 TLSH

Submit Download

serviceid.dat.afos_complete

Path C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\serviceid.dat.afos_complete
Size 16KB
SHA256 1ae529f030886fcf63d4f5a8855ff22a21e687a0e200fba5d4f06f707d399755
MD5 9beb638faee82c2630a8fb9b85df1559
SHA1 edc24094b4609ffe279e8bbe1ab59089ae7e51c2
SHA512 036e7d9aa5d4167d784c067bd6637cfc3d5408e036a32f1481675118847aed553e5dbbcd25168f0e9eaf0dbfbcbbf20fda517e3144296f81553b9c13435c3701
SSDEEP 3:h5hcjbQPbBJvEUCi7qD4hPl/:ujGBJcNi77Pl
TLSH
T1F37212DA214123B8C2744D331A018881830C0EC010D7074CC626512B216040CAC4C955
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JreNameOverride.afos_complete

Path C:\ProgramData\JWrapper-Remote Access\JWApps\JreNameOverride.afos_complete
Size 13B
SHA256 e4c596fe101978f244b8f74be616d62bbaae083f881928da51255b0dba50d440
MD5 8199887131477d02232d372bc808cfd5
SHA1 c172ffd15c0fb02432429632272a066b8516e077
SHA512 8623a7e6bb4673572c47035280cecbf09d02a71de54f86a2a3376de080df33af8dbe0d2e5c460779a899ca3d51e5b4c7b1a264ed4089af40b05c187524606026
MD5 SHA1 SHA512

Submit Download

jwutils_win64.dll

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-JWrapper-00075795284-complete\jwutils_win64.dll
Size 184KB
SHA256 49c49b94e2a50b865f8a39eb8497bd97a9f3f4c585cd671f8c8fd2b05a24639a
MD5 e7a1e6e40b24adfea986efbcba166bcf
SHA1 f65b974bfaddf8df2e2f812cec31f0a793982ac7
SHA512 2d15c6e9cb3251d2823642319cc7e280c81b0a11cdd8bfea89f0506a3d8526c992e76ebd96cf6f8e33c5062f4f2e62dad3a900e3469938f5f7396caf94e6c1f9
SSDEEP 3072:aDPALDiICFHxb9Prh6Wm2Tv/dchUsZOqSc52ZK26yjdsBqpQ/YSPbR8za:4OGIy7Ru2sZO9cVcjGBJzPbRka
TLSH
T116045A96B29650F5D1BBD23CCAD24756FA7234144324A3CB16A48B792B73BE4B73D320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nativesplash.png

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-JWrapper-00075795284-complete\nativesplash.png
Size 8KB
SHA256 5ac80b373a7de315cc803eea0fc640335369df062de52b53c2a4175af2c0a2a7
MD5 08051133e368d61036576d3ed5b9cc14
SHA1 817e7a73eb33ab39e3c4d8c99a00c9d05c64f5c5
SHA512 93400dc7b885e2f51942ccba11ed7f1ebc82b9d726aa3b5c11ea118bfa93d20594243449ce37195cf72387064514c01d0d2d38776d7d049e148050edf873b7ce
SSDEEP 192:XFcpG2JMh/HwqndQb0qZzAuc6SyLK8hC5W+Cyd9kipsR5iyjR:ik48YadQbxO6PLpCWHGVSIyjR
TLSH
T16112BFCC406E7CA471E2012A8A44C75117B625B11D55BE2A3A41DCEB618CEDF2CFBAD7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jwBuildVersion

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\jwBuildVersion
Size 11B
SHA256 6afd7786f03601285735b5053a5131887128fd9a214ecf1909290ccf49f01c07
MD5 daa3c36025e2f86bd0a8d8bf3be8353b
SHA1 e8a75213e06f643802ea1d7c821644b7327f442e
SHA512 4e9395c0895978b577ed58fcf05c5d0d2001f70930bda667e54971c6a1dc9c242f919a31831962dece5faf725437721466904fb668847208f7422f83245e281e
MD5 SHA1 SHA512

Submit Download

jwLastRun

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\unrestricted\jwLastRun
Size 13B
SHA256 5fedf86dc889599ce1113dff6874eccdb701adaddda01b51b615f5abf39691d1
MD5 319a69e54b4213441588062be680e09b
SHA1 6a6004e1603344fd7388353d99e07f819a38df1a
SHA512 2a5284ca7837f5932a3b98084dba1896be0ccadc1f2403bdabaadfefbf2fb3455e85ffdbf7b5950f6467fe5935de1c28b3442a9923c4b54ba0ef1f40d5230b86
MD5 SHA1 SHA512

Submit Download

jwLastRun

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\unrestricted\jwLastRun
Size 13B
SHA256 530958af58c988b6691694c58468db614811880dc843dedb6e6d6f9a7b861f66
MD5 76b3b09b8542fa3733c823023970139c
SHA1 b0d80b50a916167515e7a7a860f9c6a9ff988360
SHA512 e07073d7a744c79bb35cf6c5e463e6ebe5500e761bba725688b014d4f4d659241dc1f600a454ec2872bea6fa0f364db4586d312e99e6e832bdb0678202930c6b
MD5 SHA1 SHA512

Submit Download

java.dll

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00063527423-complete\bin\java.dll
Size 157KB
SHA256 5f77d3d190d3cb4ebb9b4f47aefe826bf6e15f383d6822e1a25a5729227ebf26
MD5 2b3f3da6a443e6be107e61628d220692
SHA1 c90416d47e8689e1338e71bb46946f7e67607fb3
SHA512 c6dcde0e83932506b5d18aa802e2747a4dd6fa9848a424a1d2db1a527b98b7676af67673d40e1a0e9b7f9bc9eecd88380273eb3d29169d681a4fd02324f6b6db
SSDEEP 3072:GwLr0BaOH91zgqMVasnXkI/M5WMsInVSVgcJj0mUgq:eTdGDVbUmYH97
TLSH
T1E9F3280B625640A7F89775B8B0166003E3B67468023D836F47E18B8E9FBF761BD97781
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

net.dll

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00063527423-complete\bin\net.dll
Size 95KB
SHA256 7181c21fa655d389d85c5cdb06c6b4359cde93e47c13269e09bfc5e87fb3cb39
MD5 dd7bf43cab35a227017af46a182c3b9f
SHA1 20cdb203f339d5ef8e80504276a9bf2051fe4342
SHA512 7f34126f121a3057b9d78120a5b8e82dc4a7f285662c0dc526fcc06a547176b66720179c4f41384f5073680d34f99d46020a23a77c2622abc0445ad08cd20d31
SSDEEP 1536:xxhrMqB0lDHzB047E3PkQKJxEFASBeU84qTRGSGkyepGi8Ljo+svghO:LhrSDF0v3PkQKXEFAhUqLrpTgls9
TLSH
T1D9932A08636860D5F877E1FCC2868607D7B3B0706620579F13A2C99B6FDBB617E19B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jvm.dll

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00063527423-complete\bin\server\jvm.dll
Size 8.4MB
SHA256 13b6c6c5c3d0f90588c6d16a2c00436dcf08044b0150a3cd71a15ee69472a6ff
MD5 be7b903d854715572c1c180344f913be
SHA1 7b2ebe4bfa6e3f2ee62e91cabd41636a56f9b77a
SHA512 af2d38a7ffc0f10e0b12cd108ae3a7054334cd4a84cd76095f00c4b28de431b94feec6e3c44e95c514f114855c209f42d58fb683f1eb246b2e2ec14538d6ce5a
SSDEEP 98304:9s4/l53KnlrNX3sEeylN951rtdsotEef3PpecH7ZL1Uk:9Z/l53Knlrt3sEeylP51rt+otEs3PzF
TLSH
T11F965A5762F000AAE9BEC278CE57E617D7F3785843319BCB66A017950B13FE52A7B210
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

verify.dll

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00063527423-complete\bin\verify.dll
Size 48KB
SHA256 7e239d228728ffacdd098196b61e954d3af7da83b9359920934330be5866ba5f
MD5 68643834b2e8b5dd58d505c0c470bb56
SHA1 2bb2db6f7ad5029e7b978c52417ea4e3053b4c23
SHA512 7674228fb64d34ea563776c5d3a5e5a052da8a1089325e981421b8ea5e5eaaf96a38f837557885e859f4c79cb1d26e82e5620c3c98505654d49f09ee2158d2d3
SSDEEP 768:OYkpGTievAR+x/Olkj1ZyiQLdYn+KP1aU19pEiOTD6EB+w4vZij+ess3hDN:KELxRn3HfpEX63rvZZe/3hDN
TLSH
T173236B6362A86875E8C39074C697EFC7DAB1F8ED0354D18F14E4960EAF4BB512BD820D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zip.dll

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00063527423-complete\bin\zip.dll
Size 77KB
SHA256 49be17444b2612bde91d0f59aeaba2ef2deb14a12baa9b90a36d1ad87f9fef4b
MD5 bcc302e0d9f6bdb71cd5cf2f846a5e76
SHA1 b9c5f74430541d08f2a99d82633c7c81530f101a
SHA512 fed292db9cc2aa4c9a9528aac676a96ed48b30dc4ae9df4113670b8b1cec59b52a28f033bbce53787aa6d168c72e2826d2e7b9df670884b96629fa6def0b681b
SSDEEP 1536:ZRUGiGvAKb3shmHisnmjx++8o9IOQIO+VnToIfYt74s3h0Ou:ZRUcvTsc3JPo3G+9TBfYt747Ou
TLSH
T1A8738C994AE091A1FAF651B4C4E68B2FC772716052D4939F529C93922F433A23F483FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JWAuxiliaryArchive-Remote Access_macutils32

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774524-3-app\JWAuxiliaryArchive-Remote Access_macutils32
Size 1B
SHA256 6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d
MD5 93b885adfe0da089cdf634904fd59f71
SHA1 5ba93c9db0cff93f52b521d7420e43f6eda2784f
SHA512 b8244d028981d693af7b456af8efa4cad63d282e19ff14942c246e50d9351d22704a802a71c3580b6370de4ceb293c324a8423342557d4e5c38438f0e36910ee
MD5 SHA1 SHA512

Submit Download

customer.jar

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774524-3-app\customer.jar
Size 16.4MB
SHA256 72c882d00a238df1b4b2f3a5026f780ab88129686ebbeb08ab718b15e690822a
MD5 12989e215d42d53a8d47206643a661dc
SHA1 01f53436ed70554811cec4b90f04c8234fc2ec0a
SHA512 06c265cc8ba38f747070cffd118c8d89ef953773bbd6cf3900a5b603b2c4a3ded3317d255bfe0ddc2eb19d81ff73836f36a5fa9631772db8573c0a979e0efe4d
SSDEEP 49152:fYvMdnX8N8ZBMhc9bz3RB/2CVWlgHS9if/vqmFt0Eu6OiGl3R1LrDtE2tVmxy/z4:fYdvhclPh5vKti2tVmxCBhhM2zsUE
TLSH
T1A0072A2BF3106E6FFB99D3BDB56183713AB068309283D161BFE958275ED61D88B442C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

customer.jar.p2

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774524-3-app\customer.jar.p2
Size 4.4MB
SHA256 b6bbeb3525ce23a79d001552f0bce93eb362f3ae6616bb589e189ab4a89caacc
MD5 49d4c8dd4112338163ae5413407e0e02
SHA1 8c135ca6998be32ca2cd02f2b2048024d0e14f2e
SHA512 f4e7a4e2553d20649fd8ade72df037f911b4c87fc2bab0b2f49c3358a5e212125018fc692b2708f2fb2c0445fcde50a475e28742b024d50a1b09bd0ab75c1b6d
SSDEEP 49152:b9ICuLxvMsl4HFEmrRORZOXWVFh43CUslIQxv0fMME5ueFcbP+cV3oaODZfSl7Vc:b9JrcEXgFib4IiXueFcbPqVfSl
TLSH
T1F3267C0BF70E629DE6911A3240B5A3496360D0493F322B937F1C5D68DD866C66E3BFC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fontbox-2.0.19.jar

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774524-3-app\fontbox-2.0.19.jar
Size 1.5MB
SHA256 e879372ee9a043774a0248e9fa61976ade727803136350633830f3d757cdb6fc
MD5 da7e494a9eb3f2f49475700ba42d98d6
SHA1 0b7d2eeff13c04c50163b1c118510acd1345dd02
SHA512 04d0d9539caa74b63e0b12d4f64bef72469ad4f8a771598e95a02e79f0ed4cd3586ef43e27ca1d766d43c8504fdb3aff3a5ff5d482ec1f46e51259eaef611cca
SSDEEP 24576:0qcKx6QH6wGDuOYCzxqTq0G5Olv2VyFj8fbkEF/Ok4uWymXkVp0vyAXK6Gbxw:0qtfawGDuXCzx62OZhN8DJGDuPmIp0Yu
TLSH
T19975221AFF41D199F41B807A23978673BC7E868CF097969B097C12FA9460C154F8BBC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fontbox-2.0.19.jar.p2

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774524-3-app\fontbox-2.0.19.jar.p2
Size 3.5MB
SHA256 a112312f601965a60c7de425685a9b3ee1445dbb043c3cd88c2ca133c2be7c15
MD5 7f2bb19d616360f7bc5e2a2e4fdbec9c
SHA1 e4e3419e519e04d96b27db2e2cbb3a72948eba59
SHA512 4478c82e609ae243c09363cb83f6f8925c21f5a12ab3e4285728b458e01315c59191b90f218e8cff5de420c5f495b261be05fa9ffd94d293de8db72c26f0a373
SSDEEP 98304:graBPvylKGpcM0vB36FgOqWfW40K0kdTCtVZY/dElZufDSXSXjvYP5BMJkl1K4GP:uknylKGp6vR6FgOzfWNKPCtVZ62lZ2WY
TLSH
T1730687F748586C40C687D16B91300DE3C22FE538664BC36973A8FA73EF8B165799BA50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jwrapper_utils.jar

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774524-3-app\jwrapper_utils.jar
Size 3.3MB
SHA256 d789a9f939f7a926fa3b08137da7466c829706a95af17d659e64fe735c410140
MD5 5fdcea0e66dade69779669d028ea4e5e
SHA1 62fe5847bb42e387f116d838c2c5872b25275505
SHA512 1c671edb102fd24504a2c92138534b42e8f35eb44b309e00dab2c6060b10b8fb29f12b176758f1220dc5553c3628d76865408a2c0e2944dd3af09976b4921c58
SSDEEP 24576:jMZiPqKIUaIZv+3S94r9vCFqZqxujw/M+dncQhMeiSujg00WfMgK:QIP0ZI1qZqxujw/lqGt7QMgK
TLSH
T150F55C17F1105E1BF281E77D19A08368777060708613F7B26FA8A82B9EE62E4EF453D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jwrapper_utils.jar.p2

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774524-3-app\jwrapper_utils.jar.p2
Size 1.1MB
SHA256 9a93a0625a78f36940d2df13a6da68126e93e663b4139a8f7de0f43809e1c0eb
MD5 4d63ad9c4e49c81199d0f271f503085e
SHA1 09e3ed532ce106933273be8370e880ab7caf47f2
SHA512 921d8d98b77dcaaf293a8ba3d7608abb5c80f9a0d59e621984b90d7d0d65fae588a7aca638b5764b1c2921ed32a22bda3175604bd417cebf9d1469c45883141f
SSDEEP 24576:eOQNb1Q3WM58lVVw5Ai8zBwk6eUeq10JQ:nQNb1QGMOi5S1J6zeyAQ
TLSH
T17F354A07F64D7BA9D1910B3508E1878A5376C0086B3227D33F1C6964DEC37EB5D2AEA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pdfbox-2.0.19.jar

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774524-3-app\pdfbox-2.0.19.jar
Size 2.6MB
SHA256 de62ce4a1513649b3b571f35f93c8b74b8ef65ea098423fa434b726c3abb4ea0
MD5 5d716baee12737ab8d96a8c41b2178fd
SHA1 ff3fdf5d0b3072bef45281e2696100ccf80c6baf
SHA512 06eabdcd14076c3938ce518a947dac27dd8cf0109fd7516248aea822da97c7d0b8ea4a7710aca3c029836cc05e6ff5c92118aaf313d3168715f0b6b2c9f5e764
SSDEEP 49152:DQwQdQveK9jNyo7G+AWZvs3q+0drCGCdIhxJr:kQvb9MMu6XRWIXp
TLSH
T12CC502A5B999C831FC1F513459E2C4727C3585CAC986708ED69C039F9EEA8681F03B9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pdfbox-2.0.19.jar.p2

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774524-3-app\pdfbox-2.0.19.jar.p2
Size 2.9MB
SHA256 7ae50f66e2e47552721b9a04d4ec76fad05ceb7c033987ccde1407f82768e338
MD5 8d2c514d341bed4db12aa51cdae10744
SHA1 962bba27490a77a473b4811f49d1bddc67887817
SHA512 56496f4d6ae34eee2884060b9e146418a9309efe7790a782712147a468c9fef858064b6df60b3726e6992ff99c3da3e17549897a5ce1f0023f1056df4f3ea7ff
SSDEEP 24576:h5rsdELbNSD/Mu8LEsaw7VGo8T0QS/+1hrxK6nZTMgjm0RzBA5voV3:7rsgiMusEsaw58S/4HK6nagjmW+oV3
TLSH
T1D1E53998728AD505C503483680E3D79351D9F60B9AE3360FB8FC7BCBCAD6B11D25A91B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSVCR100.dll

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774525-4-app\bin\MSVCR100.dll
Size 808KB
SHA256 b4bfa27f677295b00a1df9a7e14db4b75cac2dd41b898d4e9a378eccce3699f0
MD5 aed6d63cfa5a3ef7021af9c457fee994
SHA1 f6ad746ef520b03df6cf0f5a2512d0df964c4688
SHA512 5573b17eb19d13cc96df5d66ef60cc8ff98e1ac9d8582a870ed2befa28ee271fb41741a92aa703234150fceadf4a436d10b8a6518c1816d0c804eb1261650d2d
SSDEEP 24576:C5e4L1vwTowTWqwVeeK7R/myyKgn9IrzOI:C5e4LfUWqAacn9Y
TLSH
T1EC059D9536A907F6D177D53DC996D206F2B2741513315BEB01A08AAE2F23FE09A3F312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unpack200.exe

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774525-4-app\bin\unpack200.exe
Size 195KB
SHA256 63f6352610d455ad5978e0d37f42a9d2f75bc092b4431d1f3cc0d5931d08152d
MD5 7e1051e9f1ed7a745c8f898e5e613cc6
SHA1 59cc4c4e86e57fc985f2f6d21a8cbc27370027db
SHA512 936e26cdd75ee13c3e9bc43b471a83126ce1737907b33cdd855d6a1818d686baa6c52dc55a208cda896cc753ff3e56447a3cef7382b64e5b13771c54ce30e37f
SSDEEP 3072:xAFlu97I7b6Cw94t0yoqIyqdYoNPyM/TBfxAqQNTwd+6Y7m9yd:xH97W6C64tthIks6GTBZAqQNTwd+nd
TLSH
T190147CA22BA011A2D9F68179D9C3C72BDBB63565037493CB50D883A21F036D46BB53FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windowslauncher.exe

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774525-4-app\bin\windowslauncher.exe
Size 350KB
SHA256 c4c3a7458bd6e320a09e880954aeab965191954c028fbc5accadec4c5f4c01f6
MD5 4ce82fc3554d7325cfcb73d60bd9862c
SHA1 ef9e23450ce2b9615ddf203f4ed49c7abdeacce9
SHA512 2aaad32f7626a8b25896238879fc1980a4b6fe3731c7c7c401df8be7a6323df29e754821a5a37b0d28b5187924459e75dd32770d98a6d7bed3030598223efb54
SSDEEP 3072:Fxi+TpxEKLUwkjJvnWsv9rJuQgnTiAkLRccllDm9tZeYGlf:mESjMsVVuQgiPluWlf
TLSH
T1DC7437B672F230F5C7B6B23989920642A761B425032273CB167085354AF77EB6E397F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

charsets.jar

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774525-4-app\lib\charsets.jar
Size 2.9MB
SHA256 293da0fddf18e7ae4e1a30ce5703716a0005e9ff5dae3784d4ec7a80df8ae798
MD5 3a7e352203320cac070079f17bfc7880
SHA1 804bb8386d681024cc813aefaaaaabfd67fe126b
SHA512 48f416034addcbe4d6a6647e7eb083272c98c364808505eb527be2e88e5d1de3aa5f8daec7b83bb6211a51b18f9c29eecb719954abb33b1b1eb83c49d3d7e131
SSDEEP 49152:OJriCuz1nXhO7dAVZd1LRIAEpT4nvvnVlbI8ew:gridzNmiN6qn3VlbI4
TLSH
T131E5AFD344491E6FD20B52BF1B60EE0B770E78AA0907B240F9B95C19E95D72F68D2F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

charsets.jar.p2

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774525-4-app\lib\charsets.jar.p2
Size 1022KB
SHA256 02f4bec339cf53d57a78912791fde50daef053954f7b5b933ff3050ad732ca19
MD5 a40d0e4736d9016b531cdc24d57f5905
SHA1 d3ee48936e12dbcbc206b18e0fe9acf219dde6dd
SHA512 4aa87a70a6f7bf5a56b5bba3885def6f4c620aa412b1abeafe8b129040d56ef53f4b3641788850e33c2bff430d9ce030815371e866a809a55ae8763449625039
SSDEEP 12288:h+BXim0XyhTMeRoqkobZ36qoRFsQn3cE1JrEU3s4F:hiym0eRog56Pn3HvF
TLSH
T1F42583037D6C3A64D61E6F714AB98F56933350183B970AEBDA186A18CEF31F35611BE0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

access-bridge-64.jar

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774525-4-app\lib\ext\access-bridge-64.jar
Size 191KB
SHA256 4fc33f9a5e88bf83bf6d9484cef092c0ee81576728ecebc1445af78e065f2f3d
MD5 71a8be3a6f8deb227ef6afb1e8e28cc7
SHA1 308cd9127ac4ab2e4affc9a030afde5472f51e16
SHA512 bbb35fc2ca545a81f91b265a74cf784fb0664e5d105e6744e65eaeb64df35f64511df15a108f47924867212cbd1fbc185eaba3f72615e0f91300f359b282e345
SSDEEP 3072:kXJV63Upvho5UoBJR6PPm+q0He0KIzhLALYlT7q9JvllY:QJX8ain6Xm+g0KUdSCT7q9Jc
TLSH
T1CD145B03FE598467F90782B350A1EE527B486D7CD0A6937F4DD91A883652C0A0736FBE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

access-bridge-64.jar.p2

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774525-4-app\lib\ext\access-bridge-64.jar.p2
Size 67KB
SHA256 d8f89da65ce9b468422ac63572f5223feaab23fd31994062aea32ff51d72e32f
MD5 a52839b91db27e6904148affbf00c910
SHA1 eea0e11bb22933a3c3821ac502db59523401baea
SHA512 96df8aead702bec74f5a2bd63b792aca4ab61e1ae8c41f0e390d752d52ced3bab9779514dd424d36ae7d47ae73d92b157ddc3861345bb0c3d8d79b0b253dcb83
SSDEEP 1536:ZUsyQQIr6KznR0M/IEzKO9als9SgqBo6OjjYIKKuSWdddddKfaW3ttapIII3gA3Q:Hm4InulFNw
TLSH
T13763A456BF8B3112E69BA7721DF07640172CC354672F27B67F68962AC4D22D3422FC4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cldrdata.jar

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774525-4-app\lib\ext\cldrdata.jar
Size 3.7MB
SHA256 19694ff19a6f89cf5fed5353457898e287ff2ea19bf314dd781fa812a665b0e5
MD5 8cb5ddb698558b042fc2711c69bd76da
SHA1 a4ec75a2b38c80508753e2e0d61785fdd64e3d4f
SHA512 9ef553cf38216cead747bceae4a62885418290e5ed529ae0aed1707794f7629ca14e7fde32592ddf565ed2a539d5aa64e16fc3d40a377bf7f371ca4613c4a3e5
SSDEEP 98304:TKiFxbGv91qcqsFydXLCAPI5+0/whCbjB0pHna5j98bkpp:1FxbGS5N/0/jSp65Jz
TLSH
T1960602D2BDB94432C27398F60420C513B509C19DF056949BDAF84A8A2AF5FD6E343EED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cldrdata.jar.p2

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774525-4-app\lib\ext\cldrdata.jar.p2
Size 3.9MB
SHA256 dd4745f9b2e9bb0be9dd7456f0409e7cbb2ebf32799c5c582d5f1d151eca9fe2
MD5 94d9c1d8b6039010549463091e3f0da1
SHA1 d9bebd56141e61567d32ca1c044d2a88f8e8febf
SHA512 b9b0cbd0353c8f1f9eae682cbdfc8116289b35f7b7108d977779b81b91f2373f758e89694ded895d6d6901de585f8627916d07f13a74292002f67ae79b27fee3
SSDEEP 49152:zwSOi8bdfSAY3YQMhHBUmrMSHQnKH1WsE:+fbd6AY+Bzr3HeR
TLSH
T15D161E9365CBBA4BA3D01F285B724268153FE65801A77F18F161B3FCEB72163EE91424
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jaccess.jar

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774525-4-app\lib\ext\jaccess.jar
Size 42KB
SHA256 f974270dae89a778068545aeac1d08e4f365491f71e51786aad201360aa5bb19
MD5 3d3d4fbe856f6f24eb4a05043629100b
SHA1 83db2742d1b33527287dbe3abb86804f73ab3f31
SHA512 782ea6c705d2095b259eaa81c3e0ac1e0d13a58d4ed1d30fe31a8b5df92a1800d452bf37a64e75e2a31691a4a9df7605fcf3748d41614a53e4142228f41ee7ac
SSDEEP 768:B+hKlewenw5eLrCj5mcLAr/vJ9zCBxAIjlJsH1jmQmSM:NQweenLAjJ9WBxA4VxV
TLSH
T19613BF576F14903BE712F2F3C226EB45B604AAB4C17640AE1D980D8937A1C4B4766EFF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jaccess.jar.p2

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774525-4-app\lib\ext\jaccess.jar.p2
Size 35KB
SHA256 14cfd2b22dec236d5f4414b0516dd237539e3740d284413adf4a68273d776dee
MD5 e86163108a0a136ee2247c8c3eedf038
SHA1 699c17815adc3f5599b0367365615a9013677728
SHA512 f8aa141ea4a806aade3f37740304ee753e1aa876bf756773a1293af774f7c7f40c9eca03aa95d82a66890442d586fb54572b774150f915a0d1d76723e4ee07e7
SSDEEP 384:3+eNocIxRNMNo8CDYhYUZ1d3Vh6yDZvi7dmXypppppppppppppppppYppppppppR:pN3IxRGND1hZ1d3Oamdm9hKa5
TLSH
T163F272062747F226C3D8FE3EABFD4249427096C8B71F28966F905058EE978C7290DD8D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sunmscapi.jar

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774525-4-app\lib\ext\sunmscapi.jar
Size 31KB
SHA256 741ecd111ccfda89abe6950185720b8c6e0cbd9c48a4aa813eaace9eedb98739
MD5 8cfda80f6092a348434153bf8c861078
SHA1 d6fb67e571917cb3247c70bfacef54143c958b91
SHA512 b611215b0c43c4bb1ba143e0088353635bf669d920f1fd6d627c600501f336202d8f67fceebc7ab1347fd5f96885f42caa6ec70f2021c53ff20edce2524e130c
SSDEEP 768:C+LghJaxLlqgX8bQ/MbUtIkgHSzgTn2Bkxh/qIDCBLhUdyzdN77lNb1Zrn1pF+63:z0hJaRo1bQ/eUtIkgHSzgaBih/qU+Lhr
TLSH
T1D7E2AF97FD9EC0E8F007CAF78114B14A275C05788D92632A87E58A0EFE11D2717167EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sunmscapi.jar.p2

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774525-4-app\lib\ext\sunmscapi.jar.p2
Size 23KB
SHA256 2144c97f87a59a82b456ad5dbf643a919ac2ecbf3bad65b6951885e00868f049
MD5 172c7486ec0fe80c8b79cb46c67b775f
SHA1 21282fb0d88e7c3ffef59150b47eee662804f252
SHA512 d04fd010875289efcd03421e3c0b6addd650b785f693bdff02e4394897c5e9a7769217ef506a352c754f02e23ec56b8c43ab7814cb9d113f2b1428a075809d28
SSDEEP 384:vvI22iHBnpHW6wjF8xdvx1ZH6R1OVgX6gljVaHaHmHMcH4HDHQH7HgrHKHzHgHIl:vvI22iHBnpMjF8jnZHOOaKgljIHaHmHJ
TLSH
T176B22A53F61E40E0F1C515FA60FA2146573CAAD2EE130B3A5E88426CF981BB787751F5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sunpkcs11.jar

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774525-4-app\lib\ext\sunpkcs11.jar
Size 238KB
SHA256 931ef9cd86cb8dad75b5c5b897a28cc50ab2c8594aa688e2a3f7fdc5e792e141
MD5 f0e38530f8daf9a35318042ffc734bf8
SHA1 0cb05e2bbe37ef9eba163bbeec512132adb56cc4
SHA512 cb5649aa16da09a7a9cf4243cbc1877efd636239dbb6cdff444453a85dc144bc009424b27c5389453c3f9f37b4caf80f400d9c68f84d86e60ad28a3fa11f4753
SSDEEP 6144:qVtYGKQoqtk8x7fe3Z62eBGvgrLQexkSXtBRCxRFhB:P8f28x7fuZ6LBmgrTCSDUxhB
TLSH
T19934F186BCAC987DE52361BFCD209246A61C0A2EC207E17F0565850DB17987A07F7FF9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sunpkcs11.jar.p2

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774525-4-app\lib\ext\sunpkcs11.jar.p2
Size 165KB
SHA256 faae5c01233308fc9b1dc81fc21d1f00abd3f9e64000272220ff51524495e43d
MD5 f63fe532d16529ff2a9c29895811f722
SHA1 fd0355837f4f35fff61ac8e868ba4cd5af8cb548
SHA512 c2447dd74396560476412d3c904dafac725adae832937ce8e82af753f2e1973230fb007fc8835d13db96d2d873351bd995fcfc9085e7181d9f7f85401222e225
SSDEEP 1536:/t1+/OCxJoKJHVFfuWtnewck+ECkpleybjWehUXykhvFokdAtjd8Eli0OGJgZfTp:/vGVvFfj49HSeybaSUXykxFlCtjdZ5qz
TLSH
T16AF35C03B20E34A1D9D227BB9DA44259123CE48D8F770B5A6DCC45ACF6461B38A73FE5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsse.jar

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774525-4-app\lib\jsse.jar
Size 657KB
SHA256 f0e62b5e2e7cce1142d2d92796e4f72ebeef5b48619d38b3119a07215fa65157
MD5 d755e0c6cb12459514483b46ed2f8450
SHA1 9a11c48ea3ed6c6aae204189bf1ae3a7008f02da
SHA512 edbaf4833acbeee0ca8c8b9e1e76c7478097cf0bb611885e64659ef5837b61e87250c3cf21566271e7b9098ee9db9b3023d2eb445890a24eea8f75cada9b8700
SSDEEP 6144:866t8vo2BJJHgi0HnPD9L9xH2xJaWYwWHmllrvNvYJAlvO6H+dWefJ4+F:EYAnV20woyDvThg
TLSH
T1B7E4C517E20D55BFF284EAFF9871432C23346C325963E3794E49492AF9C65F14AB0AE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsse.jar.p2

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774525-4-app\lib\jsse.jar.p2
Size 187KB
SHA256 34ea8e6503dca372934b0f919d605c166f9a2927b2f9e7a4ec1bc1cbaaff1aec
MD5 7063c170a35de18153b4a3cc051896fe
SHA1 704454a9b40a71ff2e7095c274208a19853088a4
SHA512 8993409a67ab94438e520cba43481882cb20b59a668a4adf90ff618816186a3c418badc0d6d3decc0b61bdfb81d44d360c97d3bfc52c85397920c11653a61367
SSDEEP 3072:Y/p7a7115iTgupo2Ap5queewfAaFGCCCCbIP/6wEkOottm1:Y/Za71jiTguO2Axeew4CPrLPm1
TLSH
T1E3147C077F0A2446E3E53A73A0F57AAA9338D108363707676F4A15A8CD875E38B1EDD4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rt.jar.p2

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774525-4-app\lib\rt.jar.p2
Size 15.6MB
SHA256 6017f2034ca6a1b30d995181f0ea836eb51eebe9bdaddfd27d95f5122978c3ed
MD5 7237793709def0be4fbdf87c8d5e669b
SHA1 23c443e48fee5f1d2387689439b154eca1e012e3
SHA512 65b3402416658ab310f439d1bca8a66fe222f7b6dfee7e7d721e98e237c1111154c85b1498a54ee1c8845352fd1f2c1ed38b5c2d35a0827dc9b3819e6505b891
SSDEEP 196608:KLUfAMux5WAA4DAVQ83sgMT2RUv+piP8jE7AU:CX5WAA4DAVQ83sgMT22RPqU
TLSH
T1A2F66D07B54F758AE2901F3140B2265E123AE2082B372B577E1C67B8DD43297BE17F99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Remote AccessWinLauncher.exe

Path C:\ProgramData\JWrapper-Remote Access\Remote AccessWinLauncher.exe
Size 538KB
SHA256 c78528c14cc391c6ea6558dddbe0cb5ad0a90ff5c09f1974d267988617ec38b5
MD5 a800e15e4a1797a2c9ede99092ea2719
SHA1 0e8b7b085d8c97baf3853ca9825732cfa980f4e6
SHA512 6482787c7f1537ff54699532fc187b13a495c8bc212489df7fd54bb23a2838870330228f811a14c399aea11bb97d1cd22a152305813b7bcd6fb885fae3c3a4b7
SSDEEP 6144:3PWh3m0k3YfHbPr+t/LRMGxrICk+zwYOLdcHGJTgUBeu:fR0BqpRMGur8wt5Tgsd
TLSH
T1D0C4E934B6E19DB9DF276AFCA14E88EB5A5FC9E303C5002327F086E5CA602D5841ED5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SimpleService.exe

Path C:\ProgramData\SimpleHelp\ElevateSH\SimpleService.exe
Size 94KB
SHA256 d3be3d6b69dd3ea3bc20d06eafc452b8810d7e58286bdbf21d194d0966f75f40
MD5 aa8bac20c523a9cd4ac3424655498d24
SHA1 e8ed0b823bc2484a80cb6d79423a204953dd0d55
SHA512 0d4dee182116e935e407eb3bef590490e718d54ccc9c12d6a94b823cbfdfec6101778f91ba7e229b7ffe9a828a90c1d13351058cf650ee189942df1e92aa85ae
SSDEEP 1536:CLbP7be/V/xaTIn5ei4dJe5xmtvgX93uSpp2ca9hXQetjiPWmV:RHj93uukbXQetjmh
TLSH
T11B93AE52B4D0C0B2C45641730985CB769B3EF8366F3A489377F81B9A9E622C55B3F28D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/396-389-0x0000000002440000-0x0000000002441000-memory.dmp

Download

memory/396-376-0x0000000002440000-0x0000000002441000-memory.dmp

Download

memory/396-481-0x0000000000910000-0x0000000000A30000-memory.dmp

Download

memory/396-526-0x0000000002440000-0x0000000002441000-memory.dmp

Download

memory/396-535-0x0000000000910000-0x0000000000A30000-memory.dmp

Download

memory/396-468-0x0000000002440000-0x0000000002441000-memory.dmp

Download

memory/396-384-0x00000000024B0000-0x00000000024E2000-memory.dmp

Download

memory/396-403-0x0000000002440000-0x0000000002441000-memory.dmp

Download

memory/1016-787-0x000002384D1A0000-0x000002384D33A000-memory.dmp

Download

memory/1868-681-0x0000000000850000-0x0000000000851000-memory.dmp

Download

memory/1868-700-0x0000000000850000-0x0000000000851000-memory.dmp

Download

memory/1868-846-0x0000000000B80000-0x0000000000CA0000-memory.dmp

Download

memory/1868-829-0x0000000013B90000-0x0000000013B9C000-memory.dmp

Download

memory/1868-828-0x0000000000B80000-0x0000000000CA0000-memory.dmp

Download

memory/1868-817-0x0000000000850000-0x0000000000851000-memory.dmp

Download

memory/1868-814-0x0000000000850000-0x0000000000851000-memory.dmp

Download

memory/1868-813-0x0000000000850000-0x0000000000851000-memory.dmp

Download

memory/1868-804-0x0000000000850000-0x0000000000851000-memory.dmp

Download

memory/1868-802-0x0000000000850000-0x0000000000851000-memory.dmp

Download

memory/1868-609-0x0000000000850000-0x0000000000851000-memory.dmp

Download

memory/1868-615-0x0000000013210000-0x0000000013242000-memory.dmp

Download

memory/1868-619-0x0000000000850000-0x0000000000851000-memory.dmp

Download

memory/1868-625-0x0000000000850000-0x0000000000851000-memory.dmp

Download

memory/1868-634-0x0000000000850000-0x0000000000851000-memory.dmp

Download

memory/1868-795-0x0000000000850000-0x0000000000851000-memory.dmp

Download

memory/1868-643-0x0000000000850000-0x0000000000851000-memory.dmp

Download

memory/1868-649-0x0000000000850000-0x0000000000851000-memory.dmp

Download

memory/1868-653-0x0000000013290000-0x00000000132C2000-memory.dmp

Download

memory/1868-655-0x0000000000850000-0x0000000000851000-memory.dmp

Download

memory/1868-659-0x0000000000850000-0x0000000000851000-memory.dmp

Download

memory/1868-667-0x0000000000850000-0x0000000000851000-memory.dmp

Download

memory/1868-674-0x0000000013B50000-0x0000000013B6A000-memory.dmp

Download

memory/1868-675-0x0000000014990000-0x00000000149C2000-memory.dmp

Download

memory/1868-678-0x0000000000850000-0x0000000000851000-memory.dmp

Download

memory/1868-796-0x0000000000850000-0x0000000000851000-memory.dmp

Download

memory/1868-691-0x0000000000850000-0x0000000000851000-memory.dmp

Download

memory/1868-792-0x0000000000850000-0x0000000000851000-memory.dmp

Download

memory/1868-786-0x0000000000850000-0x0000000000851000-memory.dmp

Download

memory/1868-766-0x0000000000850000-0x0000000000851000-memory.dmp

Download

memory/1868-718-0x0000000000850000-0x0000000000851000-memory.dmp

Download

memory/1868-735-0x0000000000850000-0x0000000000851000-memory.dmp

Download

memory/1868-758-0x0000000000850000-0x0000000000851000-memory.dmp

Download

memory/2072-773-0x0000018FECE00000-0x0000018FECF9A000-memory.dmp

Download

memory/2168-588-0x00000000009D0000-0x0000000000A92000-memory.dmp

Download

memory/2568-776-0x00000165F7780000-0x00000165F791A000-memory.dmp

Download

memory/3168-482-0x0000000000B60000-0x0000000000C80000-memory.dmp

Download

memory/3168-480-0x0000000002420000-0x0000000002421000-memory.dmp

Download

memory/3168-473-0x0000000014550000-0x0000000014582000-memory.dmp

Download

memory/3168-467-0x0000000002420000-0x0000000002421000-memory.dmp

Download

memory/3524-761-0x00000186BB2D0000-0x00000186BB46A000-memory.dmp

Download

memory/4384-791-0x000001DE3A200000-0x000001DE3A39A000-memory.dmp

Download

memory/4444-585-0x0000000000830000-0x00000000008F2000-memory.dmp

Download

memory/4516-539-0x00000000146C0000-0x00000000146F2000-memory.dmp

Download

memory/4516-536-0x0000000002420000-0x0000000002421000-memory.dmp

Download

memory/4516-546-0x0000000002420000-0x0000000002421000-memory.dmp

Download

memory/4516-595-0x0000000000B50000-0x0000000000C70000-memory.dmp

Download

memory/4516-596-0x0000000002470000-0x000000000247C000-memory.dmp

Download

memory/4516-589-0x0000000002420000-0x0000000002421000-memory.dmp

Download

memory/4516-554-0x0000000002420000-0x0000000002421000-memory.dmp

Download

memory/4516-533-0x0000000002420000-0x0000000002421000-memory.dmp

Download

memory/4516-582-0x0000000002420000-0x0000000002421000-memory.dmp

Download

memory/4516-566-0x0000000002420000-0x0000000002421000-memory.dmp

Download

memory/4796-827-0x00000000009C0000-0x0000000000A82000-memory.dmp

Download

memory/5100-599-0x0000000000B40000-0x0000000000C02000-memory.dmp

Download